All broken

Many things stopped working on my Win XP Pro laptop.

Where do I start ?
No, I am not going to re-install Win XP Pro .... YET !

For example.
FireFox downloads work but when I try to click on the folder Icon
nothing happens (usually the folder containing the downloads opens).

RecycleBin - cannot delete files there from the recyclebin itself.

Many other abnormalities.

Suggestions please.

Wish Macrium Reflect had a Window only backup. i.e. the Windows OS only
and not all the apps and data.

I used CCleaner and Glary Utility to clean up but it as no help.
Suggestions please.

On 01/03/2018 18:40, BOM wrote:
Many things stopped working on my Win XP Pro laptop.

Where do I start ?


Just reformat the HD and reinstall Windows XP or go and buy a new
machine with Windows 10 pre-installed and your problems would be solved
forever.

Your XP machine must be very old and so the hardware needs to be replaced.

/--- This email has been checked for viruses by Windows Defender
software.
//https://www.microsoft.com/en-gb/windows/comprehensive-security/




--
With over 600 million devices now running Windows 10, customer
satisfaction is higher than any previous version of windows.

BOM wrote:
Many things stopped working on my Win XP Pro laptop.

Where do I start ?
No, I am not going to re-install Win XP Pro .... YET !

For example.
FireFox downloads work but when I try to click on the folder Icon
nothing happens (usually the folder containing the downloads opens).

RecycleBin - cannot delete files there from the recyclebin itself.

Many other abnormalities.

Suggestions please.

Wish Macrium Reflect had a Window only backup. i.e. the Windows OS only
and not all the apps and data.

I used CCleaner and Glary Utility to clean up but it as no help.
Suggestions please.


Walwarebytes offer a free on-demand scanner. It is run
while the OS is running.

Kaspersky and BitDefender offer bootable CDs for offline
scanning. You boot those instead of the regular OS, and
the CDs scan the C: drive for you.

For adware scanning on a running system, you can use this.
One of the anti-mwlware companies (actually Malwarebytes)
has bought this from the developer. So it's no longer a
one-person development effort.

https://www.bleepingcomputer.com/download/adwcleaner/

*******

For your Malwarebytes MBAM download, it currently is a "trial"
version (real time protection) which will fall back to
"free mode" (on-demand scan) in 14 days. That's according
to the description here. This page also has a reference to
a previous version 2.2 before version 3 came out.

http://www.majorgeeks.com/files/deta...i_malware.html

The product has downloadable definitions, so perhaps version 2.2
plus definitions might work. That page has a link to the
definitions. The idea of picking up definitions in advance,
is if your machine doesn't have good download (like dialup).

When I do experiments like that, I back up the partition I'm
working on first. If I don't like what one of those products
is doing, I restore from backup. It's easier than trying
to find some "remover" app specially crafted to remove it.

Apparently, the MBAM approach isn't quite the same as it
was at one time. At one time, you could get just the free
version, do an on-demand scan, and you were done.

MBAM runs while the OS is running. Good malware will
stop MBAM from starting. If that happens, you can
look for "MBAM Chameleon" which basically just tries
to rename the executable before launching it. As the
current version seems to have an installer, and doesn't
look "portable" like the original, I suppose that's no
longer a possibility.

You could also back up C: and install a Kaspersky trial
version, and see what it detects. Then restore from backup,
once you know what the name of the threat is. KAV can
burrow into an infected machine and install anyway. It
might take three or four reboots before it overpowers
the malware. The one time I've done that (used the
trial), I was pretty impressed with their technique.
You could hear the malware go "ugh" as it got wiped out.
So much disk grinding...

Malware removal tools don't do a good job of cleaning
up the Registry later. You may attempt later scans,
and have a scanner pick up "registry fingerprints"
caused by Start entries that point to... non-existent
files. So while a malware cleanup removes the virulent
files, it doesn't typically remove the registry entry
that points to them. After the infected EXE thing
is removed, it doesn't matter. Except the Registry
entries are a kind of signature and other scanners
will spot them later.

I helped a guy remove a couple of those (registry entries),
and we had to come up with a way to get "permission" to
delete the registry entries. Pretty funny stuff,
when being admin isn't enough. And a Registry Cleaner
won't help, because the Cleaner is going to think
they are regular legit things.

With a malware, you have to remove

1) The active infection.
2) The "backup plan" that puts the infection
back on every reboot.

It's (2) that makes them persistent. And simple
minded removal techniques (the kind of stuff I
can handle), won't help.

There are malware removal sites, like Bleepingcomputer,
that have a flow-chart removal process. They will ask
you to do some scans and post the log files. They analyze
the contents of the log, and then prescribe a series
of actions in response. The process goes "scan-remove-scan-remove"
until it's clean. I've seen some threads from that spread
over a two week period, with multiple people being
consulted in the background. When brand-new malware
is spotted, it takes the staff there a while to
find a weakness to overpower it. Using RKill all
the time, isn't going to be enough, if your
opponent knows you have RKill. The people on offense
have all the tools, and test before release with them.

And a Black Hat cannot upload to virustotal.com,
because the "sample" that gets scanned, will
immediately be added to 60 different AV databases.
So if you "let the cat out of the bag", your
"surprise" is ruined. While they could use
a scanner like that, it's the "leaving behind of a sample"
that makes it not worthwhile to do it. They
need to use scanners that don't have a network
connection, and cannot call home.

Paul

In message , Paul
writes:
BOM wrote:
Many things stopped working on my Win XP Pro laptop.
Where do I start ?
No, I am not going to re-install Win XP Pro .... YET !
For example.
FireFox downloads work but when I try to click on the folder Icon
nothing happens (usually the folder containing the downloads opens).
RecycleBin - cannot delete files there from the recyclebin itself.
Many other abnormalities.
Suggestions please.
Wish Macrium Reflect had a Window only backup. i.e. the Windows OS
only and not all the apps and data.

I keep any disc partitioned, with C: for OS and software (including its
settings), and D: for data. Makes making a Macrium image a lot quicker.
(If you do, make sure the image includes any hidden partitions that
Macrium can see.) I then just make a copy of D: - if you use SyncToy or
a similar utility, that's a lot quicker than imaging as it only copies
the changes. You can partition your disc retrospectively (ideally doing
an image of the whole thing first) - try with the built-in facility, or
if that fails, one of the free ones (I use the EaseUS one, but there are
plenty). You might have to do a shrink (possibly preceded by a defrag)
first, then a move of some data, then maybe a repeat of the process a
few times; endless arguments, but I'd say 50G for XP-plus-software, and
100G for 7-plus-software, though both will fit in 30G at a pinch.

I used CCleaner and Glary Utility to clean up but it as no help.
Suggestions please.


Walwarebytes offer a free on-demand scanner. It is run
while the OS is running.

Kaspersky and BitDefender offer bootable CDs for offline
scanning. You boot those instead of the regular OS, and
the CDs scan the C: drive for you.

Excellent advice/article (as usual from Paul!) about anti-malware, and
I've marked it keep for reference; but we shouldn't _exclude_ the
possibility that the cause may be something else - otherwise BOM may
still have the problems after doing the scan.
[]
I helped a guy remove a couple of those (registry entries),
and we had to come up with a way to get "permission" to
delete the registry entries. Pretty funny stuff,
when being admin isn't enough. And a Registry Cleaner
won't help, because the Cleaner is going to think
they are regular legit things.

That's interesting. What, even if they point to non-existent files? I
thought those were one of the few things registry cleaners did well, and
one that is fairly safe.
[]
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

"I'm a self-made man, thereby demonstrating once again the perils of unskilled
labor..." - Harlan Ellison

Try Free Glary Utilities.
CCleaner and Glary get different things.
Who's on first ? Run the other next and visa versa.